NULL pointer dereference in Snort - CVE-2026-20221
Published: October 21, 2026
Vulnerability identifier: #VU156723
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-20221
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service or bypass traffic inspection, depending on device configuration.
The vulnerability exists due to a null pointer dereference in the GRE tunnel decapsulation feature of the Snort 3 Detection Engine when processing nested GRE traffic. A remote attacker can send a crafted GRE payload through an affected device to trigger an unexpected engine restart, resulting in a denial of service or an inspection bypass depending on device configuration.
On Cisco IOS XE devices, exploitation requires the Unified Threat Defense (UTD) package to be installed.
Affected software
Snort
How to mitigate CVE-2026-20221
Install security update from vendor's website.
Snort - update to 3.12.4.0